How to defend against a password spraying attack? – Source: securityboulevard.com

Password spraying attacks are becoming a serious threat, especially targeting Active Directory environments. These attacks enable attackers to exploit weak passwords and gain unauthorised access by applying login attempts across multiple accounts, making them difficult to detect. They also bypass account lockout mechanisms, causing significant risk to organisations.

In this blog, we will detail how password spraying attacks work, provide real-world examples, and explain why they seriously threaten Active Directory. We have also covered proactive defence strategies, including network segmentation and detection tools, which can help you improve your security posture and reduce the risks associated with this attack.

What is a Password Spraying Attack?

A type of brute force attack that targets multiple user accounts with a few generally used passwords instead of attempting many passwords against a single user account is known as a password-spraying attack. This is performed using the same password cycling through the username list until a successful account is identified.

This attack avoids account lockouts which commonly appear after multiple failed attempts. Password spraying attacks are secretive, and security monitoring tools fail to detect them, enabling malicious activity to go unseen by other tools.

These types of attacks exploit drawbacks in organisational policies related to password security and human behaviour. Basically, any organisation’s Active Directory for authentication can be vulnerable.

How does it work?

Password spraying attacks exploit both network security mechanisms and human password behaviours. By spreading login attempts across many accounts and possibly over extended periods, attackers significantly reduce the risk of detection, making password spraying attacks especially dangerous to network security.

Here are the following steps of how this attack works:

1. Enumeration: Attackers use various techniques to gather a list of usernames within the target organisation. Such techniques include phishing, social engineering, public information harvesting, and directory harvesting attacks.
2. Password selection: Once the list of usernames is gathered, the attacker selects passwords for the spraying attempt. This process is performed by standard password practices and trends including:
   • Common defaults
   • Simple password patterns
   • Using temporal events or user preferences to update passwords based on current events and seasonality.
   • Easily guessable passwords such as “password”, “12345678” or “admin1234!”.
   • Data from previous breaches (often people reuse passwords across different services).
3. Spraying: The attackers begin the spraying phase with usernames and passwords. This step involves spreading the login attempts across multiple user accounts to avoid repeated failures on any single account. Attackers take advantage of this approach to stay undetected from the account lockout points. To avoid detection mechanisms, the attacker times each login attempt carefully, pausing between attempts or performing the attack outside normal business hours.
4. Access and lateral movement: After a successful authentication, the attacker gains an initial foothold within the network. After that, they can conduct privilege escalation by upgrading the compromised account’s privileges to achieve broader access to resources. They can also identify and access sensitive information involving personal employee data, financial records, or intellectual property. They can also use compromised credentials for lateral movement and deeply infiltrate the network, eventually compromising more accounts or deploying malware.

Real-world examples of password spraying attacks

Now we will have a look at some real-world examples of password spraying attacks:

A large botnet targeting Microsoft 365 Accounts (2024)

A botnet of more than 130000 compromised devices used spraying attacks against Microsoft 365 accounts against non-interactive sign-ins leading to account takeovers, internal access and infiltrations.

This led to several organisations facing data breaches due to employees using simple or default passwords. This attack highlighted the significance of strong password policies and the vulnerability of cloud-based applications.

SolarWinds Supply Chain Attack (2020)

In 2020, the SolarWinds breach involved using a password-spraying technique to gain access to certain systems, although it was primarily known as a supply chain attack. In this attack, attackers infiltrated networks by targeting low-level employee accounts with weak passwords.

As a result of this attack, the breach impacted numerous high-profile organisations and government agencies, causing overall operational and security disruptions.

I can provide an endless list of examples, but that would defeat the purpose of this article and its lessons. This is a commonly used technique by ransomware and other threat actors because it provides higher chances of success when targeting remote work infrastructure like remote desktop services, VPNs, and cloud-based platforms.

Many companies lacking strong multi-factor authentication suffered significant security breaches. This incident highlighted the significance of implementing strong cybersecurity measures in remote work environments.

Why Password Spraying Attacks are a Threat to Active Directory?

Password spraying attacks target weak authentication mechanisms to gain unauthorised access, and thus, they pose a significant risk to Active Directory (AD) environments. A successful attack can lead to severe consequences, as AD is the backbone of enterprise identity management.

Impact on Security

An attacker can laterally move across the network after compromising an account, using password spraying to aim for higher-privileged accounts. This can lead to privilege escalation, allowing attackers to take control of critical systems, deploy ransomware, or exploit sensitive data.

Vulnerabilities Exploited

Password spraying attacks target weak password policies, such as simple, commonly used, multifactor, or lack of multi-factor authentication (MFA). Additionally, misconfigured authentication settings and poor Active Directory monitoring create blind spots, enabling attackers to work undetected.

Potential Damage

A successful attack can result in unauthorised access to confidential data, compliance violations, and disruptions of business operations. Compromise AD environments may cause organisations to suffer financial losses, penalties, and reputational damage.

How to Defend Against Password Spraying Attacks?

Defending against password spraying attacks involves both technological solutions and organisational practices. Let’s explore each solution:

Enable account lockout policies

To prevent password spraying attacks, you can set Account Lockout Policies by setting a point or threshold for failed login attempts, which will temporarily lock the account. How can you implement this?

Configure this through Group Policy (gpmc.msc) in Windows Active Directory (AD) under Account Lockout Policy by putting a limit (for example, five failed login events) and lockout duration. Password protection should be allowed for Azure Active Directory (Azure AD), and a lockout threshold should be selected in the Azure Portal. Tools like Fail2Ban or PAM configurations modification can be done on Linux servers to block repeated login attempts, improving protection against automated attacks.

Implement strong password policies

Strong password policies reduce the risk of passwords being easily guessed. To make the password complex and strong, use password combinations that are 12-16 characters long, including upper-case, lower-case, numbers, and special characters (!, @, #, $, etc.). Avoid using common words or phrases and easily guessable passwords (like “Password123” or “CompanyName2025”).

Prevent users from reusing previous passwords. Also regularly audit password strength and account settings.

Implement Multifactor Authentication (MFA)

Even if a password is compromised, MFA reduces the risk of unauthorised access. Implement MFA for all user accounts, especially for privileged accounts. Users should be educated on the importance of Multi Factor Authentication and how to use authentication methods securely.

Monitoring and Detection

Detect anomalous login patterns that signify password-spraying attacks by enhancing the capacity to detect and respond to suspicious behavior. Implement tools for complete logging and analysis of authentication attempts with failed and successful logins. Implement protocols such as instant investigation and containment procedures for alert response on suspicious activities.

Network Segmentation

It acts as a defence mechanism against password-spraying attacks. It limits an attacker’s lateral movement by dividing a network into smaller, separated segments or zones. Organisations can minimise the impact of a compromised account by isolating critical systems, sensitive data and servers from less secure network zones.

If an attacker, for example, gains access to a low-privileged user account without crossing segmented network boundaries, which usually require additional authentication or permissions, they won’t easily access critical systems or databases. This containment strategy reduces the potential damage of password spraying attacks.

Regular security assessments and penetration testing

Conduct regular active directory security assessments, vulnerability scans, and procure regular CREST penetration testing services to identify and reduce potential vulnerabilities.

How to detect Password Spraying Attacks?

A proactive and layered approach is required to monitor and analyse to detect password spraying attacks.

Organisations must use a combination of methods to identify suspicious activities as soon as they can:

Monitor for unusual login attempts or failures

Ensure there is a use case behind which attempts to be considered for logging, for example, successful and failed login attempts would quickly eat up your storage. This balance of relevant events to be logged is essential to ensure you are not overloading analysts with alert fatigue and to include relevant events. Establish a baseline value for failed login attempts for a predetermined time. A password-spraying assault may be indicated if several accounts’ unsuccessful login attempts increase abnormally beyond this threshold. It is necessary to monitor suspicious login attempts, such as those from unusual regions or odd hours, particularly when they happen on several accounts.

You can check for Event ID 46725, which indicates a failed logon attempt. Multiple failed logins across different accounts from the same IP address can indicate a password spraying attack.

It is also recommended to check for Event ID 4771, which indicates that Kerberos pre-authentication failed. Check for failure code 0x18, which indicates bad password attempts.

Under ADFS 2016, you have various levels of auditing levels available, allowing basic and verbose logging levels: